Security Enhancements for GetSatisfaction Communities

tl;dr (“too long; don’t read”, or, The Executive Summary)

To better protect your community data, we’ve enabled industry-standard SSL security for all GetSatisfaction communities except those that use Domain Aliasing. If your community uses Domain Aliasing, we’ve got a solution for you, too.

Beginning March 15, 2012, SSL security will be a requirement for communities with Salesforce integrations. Our Customer Success team is already assisting communities with the Salesforce integration and Domain Aliasing to make this transition. Communities with the Salesforce integration and without Domain Aliasing are already “good to go”.

If you use single sign-on (“Fastpass”), you’ll eventually want to make a minor change to your Fastpass integration in order to reduce login latency. Also, there is some cool technical stuff that we did, so if you’ve got a few minutes you might find it interesting to read to the bottom.

Who Has Time?

At GetSatisfaction, we know that one of the biggest benefits we deliver to our customers is simplicity and ease-of-use. We know that you’ve got a long list of things to do, and wrestling with an overly-complex SaaS product isn’t anywhere on that list. So, whether you’re a local retailer or a Fortune 500 company with dozens of product lines, our goal is to make sure that your GetSatisfaction community should “just work”, and work right, the first time and every time.

That’s why, when we add new features, it’s critical to us that existing communities continue to operate smoothly whether they plan to use the new feature or not. Our recent releases such as mobile support and community localization are good examples of this: transparent to our customers until they are needed, then suddenly very useful.

However, if we Satisfactioneers do our job right, sometimes the improvements are a little too subtle, and we have to write a blog post to let people know about them. In that spirit, today I’d like to talk about a set of changes we’ve made to the GetSatisfaction platform to improve the security of your community.

Are You Sure This Line is Secure?

The most obvious change to the getsatisfaction.com site is that all community pages are now served over industry-standard SSL connections. That means that all data being transmitted between your customers’ (and community admins’) web browsers and our servers is strongly encrypted. This protection is identical to what major financial institutions and retailers use to protect your online banking and shopping experiences from unwanted eavesdropping.

…but if you weren’t looking for it, you might not have ever noticed this upgrade.

For customers or other users who have links to http:// URLs pointing to getsatisfaction.com communities or topics, don’t worry: when we receive such requests we simply “redirect” them to the equivalent https:// URL so quickly that users won’t even notice.

But My Community Uses Domain Aliasing. What About Me?

SSL not only guarantees secure data transmission, it also gives web users certainty about which web site is at the other end of the conversation. (Imagine if the POTUS picked up the Red Phone to talk with the Russian president, only to find out that his conversation was being transmitted securely to Dr. Evil instead!)

To provide this assurance, web browsers will compare the name of the web site they think they are going to (whatever you typed in the URL bar) with the name of the site on SSL certificate presented by the web server at the other end. If the names don’t match, your browser will assume that you are undergoing a spoofing attack put up a truly scary-looking message like this:

For our communities that GetSatisfaction’s Domain Aliasing feature, this creates a sticking point: GetSatisfaction can’t enable SSL for the aliased domain because the getsatisaction.com SSL certificate host name (*.getsatisfaction.com) doesn’t match the host name of the Domain Alias-ed community. What’s more, because of the way that certificate authorities work, GetSatisfaction couldn’t acquire a certificate on behalf of its customers even if we tried!

If you’re the admin of a Domain Alias-ed community and you’re feeling green URL bar envy, don’t worry: we’ve got your back. Our new Domain Alias management tool allows community admins to upload an SSL certificate that matches the name of their aliased community:

Once an SSL certificate is uploaded into this tool, a dedicated, redundant, scalable load balancer is automatically provisioned for that certificate. After the necessary DNS changes are made, all traffic is routed through this load-balancer to provide a seamless SSL-secured, domain-branded community experience:

Domain Aliasing over SSL is available to customers on our Enterprise Plans. If you’re an Enterprise customer and are interested in using Domain Aliasing over SSL, please reach out to our Customer Success team for assistance. If you’re not an Enterprise customer, but are interested in learning more, please contact our Outreach team for assistance.

What About Those Millions of Topics From the Past?

Our existing historical database of all topics, replies, and comments also proved to be a bit of a wrench in the works. Since we allow users to insert (sanitized) HTML into their replies, our database is littered with millions of references to non-SSL assets that would cause the scary mixed content warning discussed above.

Our solution was to proxy requests for those assets through our own servers. So, if a customer posts an img tag into community topic or reply with this URL:

Our web servers simply decode the incoming URL (the thing with all those nasty letters in it) into the original URL, and pull it from the original server before serving it back to your visitor over SSL. This preserves the facade of SSL-everywhere for your visitor, and the happy green bar stays green.

Implications for Communities With Advanced Customizations

GetSatisfaction allows its customers to have a high degree of control over the look and feel of their community. This can be accomplished through simple customizations such as a custom color palette or background image, or through the inclusion of advanced customizations such as community-specific CSS stylesheets. (In the biz we call any of these sorts of page elements “assets”.)

Unfortunately for GetSatisfaction, browsers really don’t like it when assets served from http:// URLs are sprinkled into pages that have been served over SSL. When this happens, the browser will pop up a scary “mixed content warning” like this:

As much as we don’t like to negatively impact our customers, we reallyreally don’t like to negatively impact our customers’ customers. Since thousands of GetSatisfaction customers take advantage of customizations, we needed to make sure switching over to SSL didn’t generate any such warnings for any of our communities.

That’s where our Customer Success team came in. They identified all customers whose advanced customizations might cause browser warnings when we flipped the switch over to SSL, and then worked with all affected customers to make sure that their customizations would result in the happy “green bar” effect when we launched these changes.

If your community uses advanced customizations, what does this mean for you? Going forward, all communities that assets hosted elsewhere to customize their GetSatisfaction community will need to make sure that the hosting URLs begin with https://, to avoid the type of browser warning shown above.

Implications for Communities with Fastpass Integrations

For communities that use single sign-on (aka “Fastpass”), their sign-on/sign-over process will continue to work. However, because of the redirection support we built for backwards compatibility to the pre-SSL days, the sign-on/sign-over process now takes two round-trips to our servers for most customers rather than one.

This is a minor nuisance that can easily be fixed by using “secure: true” instead of “secure: false” in the Fastpass integration code. Our Customer Success team will be reaching out soon to customers with Fastpass integrations to help them make this change.

Summary

We’re excited to have brought additional security to our communities with minimal disruption – one of a long line improvements lined up for the coming year. For those customers who need to make adjustments to their Domain Aliasing or Fastpass configurations, we’ll be reaching out soon to let you know how to make the required changes painlessly and seamlessly. Until then, your community should continue to operate exactly as it has in the past.

Nick Marden has worked in various corners of the Internet as a web developer, systems engineer, software architect, and CTO since 1994. He has been at GetSatisfaction since 2011. He lives in Reading, Massachusetts with his wife and three kids.